JP3643087B2 - Communication network, router and distributed denial-of-service attack detection protection method - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention belongs to the field of Internet security improvement technology that copes with a DOS attack (Denial of Services attack) in an IP communication network.
[0002]
[Prior art]
A distributed denial of service attack (DDOSA) will be described with reference to FIGS. FIG. 7 is a conceptual diagram of a conventional communication network. FIG. 8 is a diagram for explaining the 3-way handshake. FIG. 9 is a diagram showing a format of a TCP / IP packet. 1 to 4 are external communication networks, the external communication network 1 includes routers 10 to 12, the external communication network 2 includes routers 20 to 22, the external communication network 3 includes routers 30 to 32, and the external communication network 4 includes , Routers 40 to 42 belong to each.
[0003]
Border routers 44 to 49 are connected by the communication network 5. A malicious user who makes a distributed denial-of-service attack is a target server in the communication network 5 from a plurality of distributed site terminals 13 and 23 via the router 10 in the external communication network 1 and the router 20 in the external communication network 2. 57, TCP-SYN (connection establishment request) packet attacks are applied all at once.
[0004]
Each of these TCP-SYN packets tries to establish a TCP session by the 3-way handshake shown in FIG. 8, and the site terminal 13 or 23 side of the malicious user abandons the session during the 3-way handshake session. That is, in FIG. 8, even if the site terminal 13 or 23 of the malicious user receives the TCP-ACK (acknowledgment response) + SYN packet (2), it does not issue the TCP-ACK packet (3). As a result, the target server 57 continues to wait for this TCP-ACK packet. Therefore, if a large number of such TCP-SYN packet attacks are frequently received, the target server 57 falls into an overload state and the server function stops. .
[0005]
An outline of the function of the TCP-SYN packet and the format of the TCP / IP packet when establishing a TCP session will be described below. FIG. 9 is an explanatory diagram of the format of a TCP / IP packet. TCP / IP packets are TCP and IP packets, which are basic communication procedures of an IP communication network, and their detailed configurations are shown in FIG. 9 as an IP header (TCP header) and a TCP header (TCP header). The IP header is composed of 20 bytes including a destination server or router address (Destination Address: hereinafter abbreviated as DA), a source address (Source Address: hereinafter abbreviated as SA), and the TCP header is SYN (connection establishment request (SYN). = 1)) and ACK (acknowledgment response (ACK = 1)) and other control flags including 20 bytes (no option).
[0006]
Communication establishment by the 3-way handshake in FIG. 8 will be described in detail. To establish a connection by TCP / IP, first, when the site terminal 13 sends a TCP-SYN packet (a packet in which SYN = 1 in FIG. 9) to the destination target server 57 ((1) in FIG. 8), the target server 57 Sends back a TCP-ACK + SYN packet (packet with ACK = 1 and SYN = 1 in FIG. 9) ((2) in FIG. 8). If the terminal is a normal terminal, a TCP-ACK packet (ACK in FIG. 9) = 1 packet) is sent back ((3) in FIG. 3), and in this stage (3), “3-way handshake” is established, and communication between the site terminal 13 and the target server 57 starts. When the malicious user's site terminal 13 performs a TCP-SYN packet attack, (3) the TCP-ACK packet is not sent back and the target server Since 57 continues the state of this packet waiting, such TCP-SYN packet frequently receives a large number of attacks the target server 57 server function falls into an overload state will be stopped.
[0007]
[Problems to be solved by the invention]
Thus, the distributed denial-of-service attack is an attack in which a malicious user overloads a plurality of distributed site terminals as a stepping stone and attempts to establish countless TCP sessions with a specific Web server. Since the transmission sources of the user are distributed, it is difficult to identify a malicious user's site terminal, and it is also difficult to take measures against a rejection attack.
[0008]
The present invention has been implemented against this background, and detects advanced attacks from malicious users such as distributed denial-of-service attacks to limit or stop malicious calls from entering the network. It is an object of the present invention to provide a communication network, a router, a program, a recording medium, and a distributed denial-of-service denial-of-service detection and protection method that can avoid the target server from being overloaded by taking an appropriate action.
[0009]
[Means for Solving the Problems]
In the present invention, a plurality of border routers in a communication network monitor TCP-SYN packets, count and aggregate TCP-SYN packets for each destination, and exchange these aggregation results among the plurality of border routers. TCP-SYN packets flowing into the communication network via the border router of the same are monitored, and TCP-SYN packets that flow in an abnormal number for the same destination are used for distributed denial-of-service attacks. This inflow is suppressed by judging that the packet is a TCP-SYN packet.
[0010]
That is, a first aspect of the present invention is a communication network including a plurality of border routers respectively connected to a plurality of external communication networks. The feature of the present invention is that the border router A means for monitoring TCP-SYN packets including a connection establishment request flowing into the network; the means for monitoring includes means for counting the number of TCP-SYN packets having the same destination address; and a counting result of the means for counting , A means for receiving the counting result of the counting means from the other border router, a counting result in the other border router received by the receiving means, and a count of the own border router by the counting means Means for counting the counting results based on the results, and the counting means is a rate of increase of the counting results within a predetermined time. Means for detecting the detection result of means for the detection when exceeding the threshold value is in place and means for issuing an alarm containing information of the same destination address.
[0011]
Furthermore, the means for counting includes means for specifying a source address of a TCP-SYN packet having the same destination address that has been counted, and the means for issuing the alarm has a detection result of the detecting means exceeding a threshold value. In some cases, a means for writing the information of the transmission source address specified by the specifying means in the alarm can be provided.
[0012]
It is desirable to provide means for suppressing the inflow of the TCP-SYN packet having the same destination address or the source address included in the alarm based on the alarm issued from the means for issuing the alarm into the communication network.
[0013]
As a result, if the site terminal of a malicious user performing a distributed denial-of-service attack can be identified, the inflow suppression by the source address as well as the TCP-SYN packet inflow suppression by the destination address can be performed. In comparison, a more reliable inflow suppression effect can be expected.
[0014]
For example, inflow suppression of TCP-SYN packets by destination address may suppress inflow of TCP-SYN packets from general terminals other than the malicious user's site terminal, but inflow by source address If it can be suppressed, it is possible to distinguish between a malicious user's site terminal and a non-malicious user's site terminal. Further, a warning can be sent to the user of the site terminal so as not to perform such an action.
[0015]
It is preferable that the notifying means and the receiving means include means for transmitting and receiving the counting result using I-BGP (Internet-Border Gateway Protocol). That is, TCP-IP is communication related to the third and fourth layers, which are the basics of Internet communication, whereas I-BGP is a dynamic route protocol, and is a boundary gateway protocol used in an AS (independent system). It is a communication function by. This makes it possible to perform reliable and quick independent communication different from normal data communication, so that it is possible to reliably and promptly detect and prevent a distributed service denial attack.
[0016]
A second aspect of the present invention is a router, and the present invention is characterized by comprising means for monitoring a TCP-SYN packet connected to an external communication network and including a connection establishment request flowing into the local communication network. The monitoring means includes means for counting the number of TCP-SYN packets having the same destination address, means for notifying the counting result of the counting means to another border router, and means for counting from the other border router. Means for receiving the counting results of the first and second border routers received by the receiving means and means for counting the counting results based on the counting results of the own border router by the counting means, the counting means comprising: Means for detecting an increase rate of the counting result within a predetermined time, and when the detection result of the detecting means exceeds a threshold, It is in place and means for issuing an alarm including information of the destination address.
[0017]
The means for counting includes means for specifying a source address of a TCP-SYN packet having the same destination address that has been counted, and the means for issuing an alarm is configured when the detection result of the detecting means exceeds a threshold value. Means for writing the information of the source address specified by the specifying means in the alarm may be provided.
[0018]
It is desirable to provide means for suppressing the inflow of the TCP-SYN packet having the same destination address or the source address included in the alarm based on the alarm issued from the means for issuing the alarm into the communication network.
[0019]
The notifying means and the receiving means preferably include means for transmitting and receiving the counting result using I-BGP.
[0020]
A third aspect of the present invention is a program, and the feature of the present invention is that it is installed in an information processing apparatus so that the information processing apparatus is controlled by a router connected to an external communication network. As a corresponding function, a function of monitoring a TCP-SYN packet including a connection establishment request flowing into the local communication network is realized, and as a function of monitoring, a function of counting the number of TCP-SYN packets having the same destination address; A function for notifying the other border router of the counting result of the counting function, a function for receiving the counting result of the counting function from the other border router, a counting result in the other border router received by the receiving function, and the counting This function implements a function that counts the counting results based on the counting results of the own border router. As a function of measuring, a function of detecting an increase rate of the counting result within a predetermined time and a function of issuing an alarm including information on the same destination address when the detection result of the detecting function exceeds a threshold value are realized. By the way.
[0021]
As a function of summing up, when realizing a function of specifying a source address of a TCP-SYN packet having the same summed destination address, and issuing a warning, when a detection result of the function to be detected exceeds a threshold value It is also possible to realize a function of writing information of a transmission source address specified by the specified function in the alarm.
[0022]
It is desirable to realize a function of suppressing the inflow of the TCP-SYN packet having the same destination address or the source address included in the alarm to the communication network based on the alarm issued from the function of issuing the alarm. .
[0023]
As the function of notifying and the function of receiving, it is desirable to realize a function of transmitting and receiving the counting result using I-BGP.
[0024]
A fourth aspect of the present invention is the information processing apparatus-readable recording medium on which the program of the present invention is recorded. By recording the program of the present invention on the recording medium of the present invention, the information processing apparatus can install the program of the present invention using this recording medium. Alternatively, the program of the present invention can be directly installed in the information processing apparatus via a network from a server holding the program of the present invention.
[0025]
This makes it possible to detect sophisticated attacks from malicious users such as distributed denial-of-service attacks using information processing devices such as computer devices, and to perform appropriate actions such as limiting or stopping malicious calls from entering the network. Therefore, it is possible to realize a communication network including a router that can avoid the target server from being overloaded.
[0026]
A fifth aspect of the present invention is a distributed denial-of-service attack detection protection method applied to a communication network including a plurality of border routers respectively connected to a plurality of external communication networks, and is a feature of the present invention. However, the border router monitors TCP-SYN packets including a connection establishment request flowing into the local communication network, counts the number of TCP-SYN packets having the same destination address, and sends the count result to other border routers. Notify and receive counting results from other border routers, count the counting results based on the received counting results in other border routers and the counting results of the own border router, and detect the rate of increase of the counting results within a predetermined time When the detection result exceeds a threshold value, an alarm including information on the same destination address is issued.
[0027]
When a transmission source address of a TCP-SYN packet having the same destination address is specified and an alarm is issued, information on the specified transmission source address can be written in the alarm.
[0028]
It is desirable to suppress the inflow of the TCP-SYN packet having the same destination address or the source address included in the alarm based on the issued alarm to the communication network.
[0029]
It is desirable to transmit / receive the count result between the border routers using I-BGP.
[0030]
DETAILED DESCRIPTION OF THE INVENTION
A communication network according to an embodiment of the present invention will be described with reference to FIGS. FIG. 1 is a conceptual diagram of a communication network according to this embodiment. FIG. 2 is a functional configuration diagram of the border router of this embodiment. 3 and 4 are diagrams showing the abnormal packet detection procedure of this embodiment. FIG. 5 is a flowchart showing the operation of the border router of this embodiment. FIG. 6 is a conceptual diagram of a communication network having more attack points than FIG. 1 of the present embodiment.
[0031]
As shown in FIG. 1, the present embodiment is a communication network 5 including a plurality of border routers 51 to 56 connected to a plurality of external communication networks 1 to 4, respectively. As shown in FIG. 2, the border routers 51 to 56 include a distributed denial-of-service attack detection protection unit 515 that monitors a TCP-SYN packet including a connection establishment request flowing into the local communication network 5. The denial-of-service attack detection protection unit 515 counts the number of TCP-SYN packets having the same destination address, and counts the inflow TCP-SYN packet count function 511 to the other border router. I-BGP communication that receives the count result from the incoming TCP-SYN packet count function 511 from another border router. A function 513, and an inflow packet abnormality determination function 512 that counts the counting results based on the counting result in the other border router received by the I-BGP communication function 513 and the counting result of the own border router by the inflow TCP-SYN packet counting function 511; The inflow packet abnormality determination function 512 detects an increase rate of the counting result within a predetermined time, and issues an alarm including the information of the same destination address when the detection result exceeds a threshold value.
[0032]
In addition, when the malicious user's site terminal is not impersonating another terminal, the incoming packet abnormality determination function 512 specifies the source address of the TCP-SYN packet having the same destination address that has been aggregated. The information of the specified source address can be written in the alarm.
[0033]
Based on the alarm issued from the inflow packet abnormality determination function 512, the router basic function 510 suppresses the inflow of the TCP-SYN packet having the same destination address or the source address included in the alarm to the communication network.
[0034]
The I-BGP communication function 513 transmits / receives the counting result using I-BGP.
[0035]
Hereinafter, this embodiment will be described in more detail.
[0036]
In the communication network 5 of this embodiment, as shown in FIG. 1, the border routers 51 to 56 monitor TCP-SYN packets flowing into the communication network 5, count and aggregate the TCP-SYN packets for each destination, The border routers 51 to 56 mutually exchange information as a result of the aggregation of the TCP-SYN packets using I-BGP, and the border routers 51 and 51 that have been found that the malicious TCP-SYN packet flows abnormally. The target server 57 is released from the overload state by suppressing the inflow amount of TCP-SYN packets addressed to the target server 57 from the source site terminals 13 and 23 or discarding all.
[0037]
As shown in FIG. 2, the router basic function 510 includes a multi-protocol function corresponding to various network layer (third layer) protocols including a relay (routing) function for delivering an IP packet to a destination host. In this embodiment, a TCP-SYN packet discard function is also provided based on an alarm issued from the incoming packet abnormality determination function 512.
[0038]
The inflow TCP-SYN packet counting function 511 counts the number of packets corresponding to the source IP address, destination IP address, information amount, and time of the TCP-SYN packet. The inflow packet abnormality determining function 512 compares the counting results of the inflow TCP-SYN packet counting function 511 in time series to determine whether the aggregated data per unit time is normal or abnormal. For example, if the increase rate per unit time Δt becomes 100 times, it is determined as abnormal.
[0039]
The TCP-IP communication function 514 is a communication function related to the third layer and the fourth layer, which are the basics of Internet communication. The I-BGP communication function 513 is a dynamic route protocol, and is a communication function based on a boundary gateway protocol used in an AS (independent system).
[0040]
Each of the border routers 51 to 56 monitors all TCP-SYN packets flowing into the communication network 5, and as a result of the monitoring, for example, the destination from the site terminal 13 of the malicious user is the target router of the border router 51. If it is determined that the TCP-SYN packet number 57 is an abnormally large number with an increase rate of 100 times per unit time Δt, for example, 99% of the packet is discarded, and the border router 52 has a malicious user site. If it is determined that the number of TCP-SYN packets whose destination from the terminal 23 is the target server 57 is abnormally large, for example, 99% of the packets are discarded. In this way, it is possible to prevent the target server 57 from being overloaded.
[0041]
The TCP-SYN packet is monitored by the border router 51 by using the I-BGP dynamic route protocol from the other border routers 52 to 56 by the inflow TCP-SYN packet counting function 511 and the I-BGP communication function 513. The acquired data is included, and both of the data are combined and the inflow packet abnormality determination function 512 determines the abnormality.
[0042]
3 and 4 show an abnormal packet detection procedure. In the example of FIG. 3, first, the TCP-SYN packet counting function 511 extracts the TCP-SYN packet with SYN = 1 by the TCP flag, extracts the DA (destination IP address) of the packet header, adds it to the entry, Count up for each entry that matches. Subsequently, the inflow packet abnormality determination function 512 finds a specific DA in which SYN packets are concentrated. In the example of FIG. 4, a list of DA = 218.60.32.1 packets in which TCP-SYN packets are concentrated is shown, and the SA (source IP) is further displayed on the concentrated DA list table. Sort by address) and identify the sender. In this way, the target server is DA = 218.60.32.1, and the SA of the malicious user's site terminal is determined.
[0043]
When DDOS is clever, sorting by SA may be difficult. For example, when a malicious user's site terminal 13 steals an IP address of a terminal in another external communication network 2 to 3 and performs a terminal attack instead, the sorting for each SA becomes meaningless.
[0044]
FIG. 5 is a flowchart showing the operation of the border router of this embodiment.
[0045]
Step 1: The incoming TCP-SYN packet counting function 511 monitors the incoming TCP-SYN packets in the border routers 51 to 56, and creates and counts a DA list (FIG. 3). The monitor counting time is from time (T0 + nΔt) to time (T0 + (n + 1) Δt) (n = 0, 1, 2, 3,...)
Step 2: The incoming TCP-SYN packet counting function 511 of each border router sorts and counts for each SA on the concentrated DA list (FIG. 4).
Step 3: As the count information of unit time Δt from time (T0 + nΔt), DA and SA information of the top 5 and the top 5 rates of increase in the output list of Step 2 are respectively sent to other border routers by the I-BGP communication function 513. Notify
Step 4: The inflow TCP-SYN packet counting function 511 for each border router receives the TCP-flow from all border routers during the unit time of Δt at time (T0 + nΔt) from the output information of Step 2 and the output information of Step 3. For each SYN packet, the number of packets corresponding to the SA IP address, DA IP address, information amount, and time is counted, and the inflow packet abnormality determination function 512 counts the number of increased packets per unit time Δt to rank Up
Step 5: The inflow packet abnormality determination function 512 determines whether there is an SA or DA whose rate of increase per unit time is 100 times, for example. If “Yes”, go to Step 6. If “No”, go to Step 4.
Step 6: The router basic function 510 of the border router into which the TCP-SYN packet having SA or DA in which the rate of increase per unit time increases 100 times suppresses the inflow amount or discards all the packets.
In this way, it is possible to prevent an overload of the target server 57 due to a malicious call.
[0046]
In addition, as shown in FIG. 6, when a malicious user's site terminal attacks the target server 57 from many points with the site terminals 33 and 43 in addition to the site terminals 13 and 23, the destination IP address is the target server. It is determined that each of the border routers 51 to 56 determines that the TCP-SYN packets of malicious calls 57 are detected by the border routers 51, 52, 54, and 55. For example, 99% of the TCP-SYN packet of a malicious call is discarded by each border router 51, 52, 54, 55, and the target server 57 is free from overload.
[0047]
A device for controlling the border routers 51 to 56 of the present embodiment can be realized by using a computer device which is an information processing device. That is, by installing in the computer device, a connection establishment request flowing into the local communication network is sent to the computer device as a function corresponding to the device that controls the border routers 51 to 56 connected to the external communication networks 1 to 4. A function corresponding to the distributed denial-of-service attack detection and protection unit 515 for monitoring the included TCP-SYN packet is realized, and as a function corresponding to the distributed type denial-of-service attack detection and protection unit 515, a TCP-SYN packet having the same destination address Inflow TCP-SYN packet counting function 511 for counting the number of packets, and the inflow TCP-SYN packet counting function 511 from other border routers are notified of the counting result of the inflow TCP-SYN packet counting function 511 to the other border router. I-BGP communication function 5 to receive counting results 3 and an inflow packet abnormality determination function 512 that counts the counting results based on the counting result in the other border router received by the I-BGP communication function 513 and the counting result of the own border router by the inflow TCP-SYN packet counting function 511. As an inflow packet abnormality determination function 512, a function for detecting an increase rate of the counting result within a predetermined time and an alarm including information on the same destination address when the detection result of the function to detect exceeds a threshold value. When the detection result of the function to be detected exceeds a threshold as a function of realizing the function to issue and the function of specifying the source address of the TCP-SYN packet having the same destination address that has been aggregated and issuing the alarm Write the source address information specified by the specified function in the alarm. And further suppresses the inflow of the TCP-SYN packet having the same destination address or the source address included in the alarm into the communication network based on the alarm issued from the function of issuing the alarm. In addition, by installing a program for realizing the function of transmitting and receiving the counting result using I-BGP as the I-BGP communication function 513 in the computer apparatus, the computer apparatus is It can be set as the apparatus corresponding to the apparatus which controls the border routers 51-56.
[0048]
By recording the program of the present embodiment on the recording medium of the present embodiment, the computer apparatus can install the program of the present embodiment using this recording medium. Alternatively, the program of this embodiment can be directly installed on the computer device from the server holding the program of this embodiment via the network.
[0049]
This makes it possible to use computer devices to detect sophisticated attacks from malicious users such as distributed denial of service attacks and take appropriate actions such as restricting or stopping malicious calls from entering the network. The communication network 5 including the border routers 51 to 56 that can avoid the server from being overloaded can be realized.
[0050]
(Example summary)
As EC (Electric Commerce) develops, the protection of websites will become increasingly important from the viewpoint of security. According to the present embodiment, the target server can detect a sophisticated attack from a malicious user such as a distributed denial of service attack and take an appropriate action such as restricting or stopping the inflow of a malicious call to the communication network. You can avoid being overloaded.
[0051]
【The invention's effect】
As described above, according to the present invention, a sophisticated attack from a malicious user such as a distributed denial-of-service attack is detected, and an appropriate action is taken such as limiting or stopping malicious network inflow. As a result, the target server can be avoided from being overloaded.
[Brief description of the drawings]
FIG. 1 is a conceptual diagram of a communication network according to an embodiment.
FIG. 2 is a functional configuration diagram of a border router according to the present embodiment.
FIG. 3 is a diagram illustrating an abnormal packet detection procedure according to the embodiment.
FIG. 4 is a diagram illustrating an abnormal packet detection procedure according to the embodiment.
FIG. 5 is a flowchart showing the operation of the border router of this embodiment.
6 is a conceptual diagram of a communication network having more attack points than FIG. 1 of the present embodiment.
FIG. 7 is a conceptual diagram of a conventional communication network.
FIG. 8 is a diagram for explaining a 3-way handshake.
FIG. 9 is a diagram showing a format of a TCP / IP packet.
[Explanation of symbols]
1-4 External communication network
5 communication network
10-12, 20-22, 30-32, 40-42 router
13, 23, 33, 43 Site terminal
44-49, 51-56 Border Router
57 Target server
510 Basic router functions
511 Inflow TCP-SYN packet counting function
512 Inflow packet error judgment function
513 I-BGP communication function
514 TCP-IP communication function
515 Distributed Service Denial-of-Service Attack Detection and Defense Unit

Claims (17)

In a communication network having a plurality of border routers connected to a plurality of external communication networks,
The border router includes means for monitoring a TCP-SYN packet including a connection establishment request flowing into the local communication network,
This means of monitoring is
Means for counting the number of TCP-SYN packets having the same destination address;
Means for notifying other border routers of the counting results of the counting means;
Means for receiving a counting result of the counting means from another border router;
Means for counting the counting results based on the counting result in the other border router received by the receiving means and the counting result of the own border router by the counting means;
This means of aggregation is
Means for detecting an increase rate of the counting result within a predetermined time;
And a means for issuing an alarm including information on the same destination address when a detection result of the means for detecting exceeds a threshold value. The means for counting comprises means for specifying a source address of a TCP-SYN packet having the same destination address that has been tabulated,
2. The communication network according to claim 1, wherein the means for issuing the alarm comprises means for writing information of a transmission source address specified by the specifying means into the alarm when a detection result of the detecting means exceeds a threshold value. . 2. A means for suppressing an inflow of a TCP-SYN packet having the same destination address or the source address included in the alarm based on the alarm issued from the means for issuing the alarm into the communication network. Or the communication network of 2. 2. The communication network according to claim 1, wherein said notifying means and said receiving means comprise means for transmitting and receiving said counting result using I-BGP (Internet-Border Gateway Protocol). Connected to an external communication network,
Means for monitoring a TCP-SYN packet including a connection establishment request flowing into the local communication network;
This means of monitoring is
Means for counting the number of TCP-SYN packets having the same destination address;
Means for notifying other border routers of the counting results of the counting means;
Means for receiving a counting result of the counting means from another border router;
Means for counting the counting results based on the counting result in the other border router received by the receiving means and the counting result of the own border router by the counting means;
This means of aggregation is
Means for detecting an increase rate of the counting result within a predetermined time;
A router comprising: means for issuing an alarm including information on the same destination address when a detection result of the means for detecting exceeds a threshold value. The means for counting comprises means for specifying a source address of a TCP-SYN packet having the same destination address that has been tabulated,
6. The router according to claim 5, wherein the means for issuing an alarm comprises means for writing information of a transmission source address specified by the specifying means into the alarm when a detection result of the detecting means exceeds a threshold value. 6. The apparatus according to claim 5, further comprising means for suppressing an inflow of a TCP-SYN packet having the same destination address or the source address included in the alarm based on the alarm issued from the means for issuing the alarm into the communication network. Or the router of 6. 6. The router according to claim 5, wherein the notifying means and the receiving means comprise means for transmitting and receiving the counting result using I-BGP. By installing on an information processing device,
As a function corresponding to the device that controls the router connected to the external communication network,
Realize the function to monitor TCP-SYN packets including connection establishment requests flowing into the local communication network,
As this monitoring function,
A function of counting the number of TCP-SYN packets having the same destination address;
A function for notifying other border routers of the counting result of the counting function;
A function of receiving a counting result of the counting function from another border router;
Realize the counting result based on the counting result in the other border router received by this receiving function and the counting result of the own border router by the counting function,
As a function of this aggregation,
A function of detecting an increase rate of the counting result within a predetermined time;
And a function for issuing an alarm including information on the same destination address when a detection result of the function to be detected exceeds a threshold value. As a function of summing up, realizing a function of specifying a source address of a TCP-SYN packet having the same destination address that has been summed up,
10. The program according to claim 9, wherein, as a function of issuing the alarm, a function of writing information of a transmission source address specified by the specifying function in the alarm when a detection result of the detecting function exceeds a threshold value is realized. 10. The function of suppressing the inflow of the TCP-SYN packet having the same destination address or the source address included in the alarm into the communication network based on the alarm issued from the function of issuing the alarm. Or the program of 10. The program according to claim 9, wherein a function for transmitting and receiving the counting result using I-BGP is realized as the function to notify and the function to receive. 13. A recording medium readable by the information processing apparatus on which the program according to claim 9 is recorded. In a distributed denial of service attack (DDOSA) detection prevention method applied to a communication network having a plurality of border routers respectively connected to a plurality of external communication networks, the border router allows the local communication network to The TCP-SYN packet including the connection establishment request that flows into the network is monitored, the number of TCP-SYN packets having the same destination address is counted, this count result is notified to the other border router, and the count result from the other border router is displayed. The count results are counted based on the received count results of the other border routers and the count results of the own border router, and the rate of increase of the count results within a predetermined time is detected. Distributed denial of service characterized by issuing an alarm containing destination address information Attack detection defense. 15. The distributed type according to claim 14, wherein when a sender address of a TCP-SYN packet having the same destination address is specified and an alarm is issued, information on the specified sender address is written in the alarm. Denial of service attack detection protection method. The distributed denial-of-service attack detection protection according to claim 14 or 15, wherein a TCP-SYN packet having the same destination address or the source address included in the alarm is prevented from flowing into the communication network based on the issued alarm. Method. The distributed denial-of-service attack detection and protection method according to claim 14, wherein the counting results are transmitted and received between the border routers using I-BGP.

Images